Mississippi Senators Consider Expert Advice on Cybersecurity

Cybersecurity experts doled out new advice to Mississippi lawmakers Tuesday as the state works to minimize cyber incidents, with mandatory cyber incident reporting among the recommendations.

This came during the Senate Select Committee on Cybersecurity’s inaugural meeting, which was livestreamed. The committee is tasked with studying state and local government’s information security stance and reviewing how cyber crimes might be prosecuted. Advice to the committee included mandating cybersecurity incident reporting, providing shared cybersecurity services and solutions, giving safe harbor to those reporting incidents, and helping jurisdictions respond to incidents.

Greg Mallette, the Cybersecurity and Infrastructure Security Agency (CISA) coordinator for Mississippi, explained how an iterative approach to cyber resilience looks as well as how CISA, which is a federal agency, can help state and local governments with planning and practice. The approach includes identifying and prioritizing services, creating asset inventories, protecting and sustaining those assets, managing disruptions and participating in cyber exercises.

CISA provides no-cost cybersecurity services, he said, including external vulnerability scanning, on-site assessments, incident-response simulations, tabletop exercises and technical guidance. The agency also helps communities identify security gaps, strengthen preparedness and build long-term cyber resilience.

His specific recommendations for Mississippi start with enabling shared procurement of things including endpoint protection and log monitoring, which locals can adopt. Some states, including Tennessee, have used State and Local Cybersecurity Grant Program funds to purchase such tools, going on to help onboard counties, cities and other public entities.

And, although Mississippi only requires mandatory cybersecurity breach reporting for state agencies, Mallette said that a safe haven for reporting should be implemented, so officials feel more at ease in doing so. Finally, the state should support cybersecurity exercises, risk assessments and cyber readiness in line with the state cyber unit’s incident response operations.

“Most of the entities that I’ve worked with don’t have a clear understanding of their entire network — the attack surface that the threat actors are taking advantage of,” Mallette said. “In most cases, it’s a lack of understanding about their operations.”

Mandatory cyber incident reporting emerged as a recurring recommendation throughout the meeting, with experts emphasizing its importance in responding to attacks across state and local government networks.

Doug Robinson, executive director of the National Association of State Chief Information Officers, identified mandatory reporting as one of five characteristics of mature state cybersecurity programs. The others include adoption of common security frameworks and performance measures, centralized shared security services, recurring cybersecurity funding and a coordinated whole-of-state approach that extends protections beyond state agencies to local governments and other public entities.

About two hours of expert presentations were followed by a wide-ranging roundtable discussion. Various related topics arose, including building the state security operations center, what whole-of-state cybersecurity might look like and AI’s impact on data and security.

Mississippi has so far this year enabled its statewide security operations center, while the state’s Department of Information Technology Services has expanded cybersecurity outreach to internal agencies. And in 2023, a Cyber Unit was installed under the state Office of Homeland Security. Cyber Unit Director Bobby Freeman was in attendance, as was state CIO Craig Orgeron. He discussed with legislators how Mississippi has been approaching cybersecurity, how the statewide security operations center might work and local procurement processes.

The select committee, established in August, is meeting ahead of the 2027 legislative session and will take recommendations to the Legislature. It is co-chaired by Sens. Bart Williams and Tyler McCaughn, and members are Sens. Bradford Blackmon, Scott DeLano, Jeremy England and Rod Hickman.

McCaughn closed on several points, stressing that the work is just beginning.

“We’re not done with these hearings. I feel very confident that an enforcement piece will be our next discussion,” he said. “A reporting requirement, I think, is a very wise thing.”